What is the CVSS score of CVE-2025-59835?

CVE-2025-59835 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P. EPSS exploitation probability: 0.1%.

Which versions of LangBot are affected by CVE-2025-59835?

LangBot versions 4.1.0 through 4.3.4 contain a critical file upload vulnerability that allows authenticated users to write arbitrary files to system directories, potentially enabling remote code…. A patch is available.

How to fix or mitigate CVE-2025-59835?

Within 24 hours: Identify all LangBot instances and their current versions. Within 7 days: Upgrade all affected deployments to LangBot 4.3.5 or later. Within 30 days: Conduct access reviews on user accounts with API credentials and implement file upload logging to detect past exploitation attempts.

LangBot CVE-2025-59835

EUVD-2025-33219 HIGH

Relative Path Traversal (CWE-23)

2025-10-02 security-advisories@github.com

Information Disclosure

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:26 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.3.5

EUVD ID Assigned

Mar 13, 2026 - 19:12 euvd

EUVD-2025-33219

Analysis Generated

Mar 13, 2026 - 19:12 vuln.today

CVE Published

Oct 02, 2025 - 19:15 nvd

HIGH 8.6

DescriptionGitHub Advisory

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.